Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

UnDP alert help

I have a need to alert when the following 2 sets of conditions are met and am not sure how to write it in the gui...

Trigger when:
All apply
   all apply
    UnDP pollername = "FireWallFailoverConfig"
      UnDP pollerstatus contains "Primary"
   all apply
      UnDP pollername = "FireWallFailoverRunningAs"
      UnDP pollerstatus contains "Standby"

This will basically tell me when my Primary unit is running in standby mode.

Is this logic the way it needs to look?

I'm just not sure if the groups correlate to a line in the table or how that works...

Find more posts tagged with

Accepted answers

njoylif

ok...think I made this way complicated.

.1.3.6.1.4.1.9.9.147.1.2.1.1.1.2.6 Primary .7 is Secondary (this is absolute no matter which FW you poll in a pair) it will just append (this device) to it as appropriate

.1.3.6.1.4.1.9.9.147.1.2.1.1.1.4.6 Primary .7 is Secondary -> Active or Standby result

So, if I only poll the primary unit then my resultset is cut in half and I'm only looking for units that have "standby" in result of the 4.6 OID and I can do a simple alert on that as I don't have to compare the 2 rows since the OID is specific to the primary...VERY round about way to figure this out.

Thanks to all for the assistance

All comments

mcbridea

Hi Larry,

If the database contains Primary and Standby as possible states then this will not worjk as the condition will always be true. If the database only contains these when they exist as a true condition you will be OK.

njoylif

yea, confusing..

it is actually two OIDs

one will return PRIMARY/SECONDARY <- "configured to be"

and the other ACTIVE/STANDBY <- "actual running state"

so if I'm running in primary - standby -> I've had a failover and I want to alert on that status.

This is a backup to traps as right now my main corporate ASA is not sending traps. it will respond to gets...

thanks for the response!!!

byrona

Hrm, from a quick look I would guess that this would work as you want but I have been wrong about this kind of thing before.

A few things that might help...

1) Grab the actual SQL query out of the Alert Definition table in the database and post it for review on this thread.

2) Set it all up as you want it but only send alerts to yourself. Then slightly alter the logic to match a "true" state to see that the alert triggers.

Hope this helps.

njoylif

I think my problem is it is comparing one row at a time and I need to do this based on comparison of two rows.

UPGRADED TO CHALLENGE OF THE MONTH

I correctly get rows back with Name =
FirewallFailoverConfiguredUnit on ....
FirewallUnitStatus on ....

but I also get rows back with Name =
moduleIndex on ...
ChassisId on ....
ipAdEntAddr on ....

I only get NetObjectID and Name back, no status...
So basically, I need to get something like:
Name = FirewallFailoverConfiguredUnit and Status = "Primary" AND
Name = FirewallUnitStatus and Status - "Standby"
FOR A GIVEN NODE
then trigger alert

here is the code:

SELECT CustomPollerAssignment.CustomPollerAssignmentID AS NetObjectID
    , CustomPollerAssignment.AssignmentName AS Name
FROM (CustomPollerStatus
    INNER JOIN CustomPollerAssignment
        ON (CustomPollerStatus.CustomPollerAssignmentID = CustomPollerAssignment.CustomPollerAssignmentID))
    LEFT OUTER JOIN CustomPollers
        ON (CustomPollerAssignment.CustomPollerID = CustomPollers.CustomPollerID)
WHERE NOT    (    (     (CustomPollers.UniqueName = 'FirewallFailoverConfiguredUnit')
    AND      (CustomPollerStatus.Status LIKE '%Primary%'))
    AND     (     (CustomPollers.UniqueName = 'FirewallUnitStatus')
    AND      (CustomPollerStatus.Status LIKE '%Standby%'))
    OR (CustomPollerStatus.CustomPollerAssignmentID
            IN (SELECT [Trigger].NetObjectID
            FROM
            (SELECT CustomPollerAssignment.CustomPollerAssignmentID AS NetObjectID
                , CustomPollerAssignment.AssignmentName AS Name
                FROM (CustomPollerStatus
                INNER JOIN CustomPollerAssignment
                    ON (CustomPollerStatus.CustomPollerAssignmentID = CustomPollerAssignment.CustomPollerAssignmentID))
                LEFT OUTER JOIN CustomPollers
                    ON (CustomPollerAssignment.CustomPollerID = CustomPollers.CustomPollerID)
                WHERE
                (
                    ((CustomPollers.UniqueName = 'FirewallFailoverConfiguredUnit')
                      AND(CustomPollerStatus.Status LIKE '%Primary%')
                    )
                AND (
                    (CustomPollers.UniqueName = 'FirewallUnitStatus')
                      AND(CustomPollerStatus.Status LIKE '%Standby%')
                     )
                )
            ) AS [Trigger]
            INNER JOIN
            (SELECT CustomPollerAssignment.CustomPollerAssignmentID AS NetObjectID
                , CustomPollerAssignment.AssignmentName AS Name
                FROM (CustomPollerStatus
                    INNER JOIN CustomPollerAssignment
                        ON (CustomPollerStatus.CustomPollerAssignmentID = CustomPollerAssignment.CustomPollerAssignmentID)
                    )
                    LEFT OUTER JOIN CustomPollers
                        ON (CustomPollerAssignment.CustomPollerID = CustomPollers.CustomPollerID)
                WHERE
                    NOT (
                    (
                        (CustomPollers.UniqueName = 'FirewallFailoverConfiguredUnit')
                        AND (CustomPollerStatus.Status LIKE '%Primary%')
                    )
                    AND
                    (
                        (CustomPollers.UniqueName = 'FirewallUnitStatus')
                        AND (CustomPollerStatus.Status LIKE '%Standby%')
                       )
                    )
            ) AS Reset ON [Trigger].NetObjectID = Reset.NetObjectID)))

njoylif

This SQL gives me the exact dataset I am looking to alert on:
Is there a way to put the SQL into the alert table?

CREATE TABLE #pollers (
      ind smallint IDENTITY(1,1)
   , nid smallint
   , cpaid varchar(50)
   , res varchar(50)
   , dt datetime
   )
DECLARE @count smallint = 0
DECLARE @nid smallint
DECLARE @res varchar(50)

INSERT INTO #pollers (
      nid
   , cpaid
   , res
   , dt)
        SELECT
        cpa.NodeID
        , cpa.CustomPollerAssignmentID
        , cps.Status
        , cps.DateTime
        FROM (
        (
        CustomPollerAssignment cpa
        inner JOIN CustomPollerStatus cps
            ON cpa.CustomPollerAssignmentID=cps.CustomPollerAssignmentID
        )
        inner JOIN CustomPollers cp ON cp.PollerID=cpa.PollerID )
        WHERE cp.PollerID IN ('E0C3AFA4-E837-46D9-BDD7-2E60BFBE0B19', '7C26F21C-4013-4411-BD42-A163159DAA1D')

select
      a.nid as nid1
   , a.res as conf
   , b.res as stat
   , a.dt as timest
   , n.HName as Host
FROM #pollers a INNER JOIN #pollers b ON a.nid=b.nid
   LEFT JOIN Nodes n ON a.nid=n.NodeID
WHERE a.res like '%primary%' AND a.res <> b.res AND b.res like '%Standby%'

DROP TABLE #pollers

output of the above in my environment:
352    Primary unit    Standby unit    2010-07-09 13:02:09.563    AP-ENT-Servo
355    Primary unit    Standby unit    2010-07-09 13:02:21.597    AP-ECL-Silex
356    Primary unit    Standby unit    2010-07-09 13:02:07.157    AP-MMS-PIX
357    Primary unit    Standby unit    2010-07-09 13:02:24.300    AP-PRX-PIX
649    Primary unit    Standby unit    2010-07-09 13:02:16.377    DP-HC-Silex
651    Primary unit (this device)    Standby unit    2010-07-09 13:02:12.097    AP-ENT-Servo-s
656    Primary unit (this device)    Standby unit    2010-07-09 13:02:19.470    AP-ECL-Silex-s
657    Primary unit (this device)    Standby unit    2010-07-09 13:02:07.313    AP-MMS-PIX-s
659    Primary unit (this device)    Standby unit    2010-07-09 13:02:20.970    AP-PRX-PIX-s
683    Primary unit (this device)    Standby unit    2010-07-09 13:02:13.907    DP-HC-Silex-s
933    Primary unit    Standby unit    2010-07-09 12:57:53.187    DP-ENT-Servo
934    Primary unit (this device)    Standby unit    2010-07-09 13:00:41.543    DP-ENT-Servo-s
941    Primary unit    Standby unit    2010-07-09 13:00:39.260    DP-CMS-Silex
942    Primary unit (this device)    Standby unit    2010-07-09 13:00:39.167    DP-CMS-Silex-s

sample of firewalls with the red being what I want to alert on:

1    104    95746691-5865-491B-BDE5-3C5263B64614    Primary unit (this device)    2010-07-09 13:02:10.847
38    104    6A1E2C27-6DCA-4CA9-B6EC-7FE530D9D67C    Active unit    2010-07-09 13:02:10.847
2    105    29633E8B-241A-4C81-B1E9-6CA3BF03F4C8    Primary unit    2010-07-09 13:02:10.377
39    105    6CAEF879-75DB-4979-9BDC-1ED6AA077750    Active unit    2010-07-09 13:02:10.377
3    352    66A6D80A-7066-4EF8-8D23-525E63945B08    Primary unit    2010-07-09 13:02:09.563
40    352    5DD3923D-E5EC-454F-AF04-3F623389DF94    Standby unit    2010-07-09 13:02:09.563
4    353    AB76A2C1-A8F2-4569-ABFD-49A87DDA0277    Primary unit (this device)    2010-07-09 13:02:21.033
41    353    93FFC0C5-524A-4D96-B8BE-B532B9231102    Active unit    2010-07-09 13:02:21.033

ctmidnight

I know this post is rather old, but I wanted to ask the question as to whether or not it would be easier to simply configure an SNMP trap alert to notify that a failover event has occurred instead of creating custom pollers and database tables to support all this collection.

I applaud this effort and believe that it is a noble quest, but I'm bummed that the vendor won't step up and enable this type of functionality within the product.

Instead; we are constantly having to hack up the database with customizations that we (the customer) are responsible for bringing forward through upgrades.

Not that SNMP trap-based alerting is well-integrated into Orion either; but at least its simpler to support at 03:00 in the morning.